Monitor Pack (MS6) - Windows - Monitor Audit Policy

It is very important to monitor the Audit policy in order to prevent a rogue administrator from turning auditing off, performing a forbidden action, and turning auditing back on.
You would be monitoring the following events for changes to your Audit Policy: